Security / IAM Architect

The Job:

As a Security/IAM Architect, you will be responsible for defining, validating, and guiding the implementation of the security and identity architecture for the upgrade from Maximo 7.6.1.3 to MAS 9.2 on Red Hat OpenShift. You will lead the transition from SiteMinder to Keycloak, federated with Active Directory, ADFS, or Microsoft Entra ID using SAML and OIDC, and support the implementation of Single Sign-On, Multi-Factor Authentication, role-based access, service accounts, certificates, and security controls across the Sandbox, Development, Acceptance, and Production environments. The role will work closely with Cybersecurity, Enterprise Architecture, infrastructure, OpenShift, Maximo, integration, and testing teams to confirm the solution meets security standards and applicable SOX and nuclear requirements. The proposal identifies this IAM modernization and broader security architecture as core components of the MAS 9.2 target state.

Job Responsibilities:

• Assess the current Maximo authentication, authorization, SiteMinder, directory, security-group, service-account, and certificate configurations
• Define the future-state MAS 9.2 identity and access-management architecture
• Design and guide the configuration of Keycloak federation with Active Directory, ADFS, or Microsoft Entra ID
• Implement and validate SAML, OIDC, OAuth 2.0, SSO, MFA, and token-based authentication patterns
• Map users, directory groups, job roles, and business responsibilities to MAS security groups and application permissions
• Establish role-based and least-privilege access for end users, administrators, developers, support teams, and service accounts
• Define authentication and authorization patterns for integrations, APIs, middleware, mobile applications, and other boundary systems
• Develop standards for privileged access, non-human accounts, credentials, secrets, certificates, and key rotation
• Support OpenShift security design, including platform access, role-based access controls, namespaces, secrets, certificates, and workload identities
• Document IAM requirements, security architecture, role mappings, design decisions, risks, and exceptions in the approved project repositories
• Maintain traceability between security requirements, solution designs, configurations, test cases, and defects in Azure DevOps
• Support security reviews, architecture approvals, risk assessments, and remediation planning with stakeholders
• Define and support authentication, authorization, role, MFA, certificate, and security-control testing
• Assist with segregation-of-duties and access-control validation where required by control environment
• Troubleshoot IAM, SSO, token, certificate, service-account, and access issues during build, testing, cutover, and Hypercare
• Develop operational runbooks and transfer knowledge to security, platform, application, and support teams.

Here's What You Need:

• Strong experience designing enterprise IAM and application-security solutions
• Experience with IBM Maximo or Maximo Application Suite security and authorization models
• Hands-on knowledge of Keycloak administration, federation, realms, clients, groups, roles, and token configuration
• Experience with Active Directory, ADFS, Microsoft Entra ID, SAML, OIDC, OAuth 2.0, JWT, SSO, and MFA
• Understanding of Red Hat OpenShift or Kubernetes security, RBAC, secrets, certificates, and service accounts
• Experience designing user, administrator, system, integration, and non-human identity controls
• Knowledge of least-privilege access, privileged-access management, segregation of duties, and access-governance principles
• Experience developing security architecture documents, role matrices, authentication flows, and operational procedures
• Strong troubleshooting, analytical, documentation, and stakeholder-management skills
• Ability to coordinate across cybersecurity, infrastructure, application, integration, testing, and business teams.

Would Be Nice To Have:

• Experience upgrading Maximo 7.6.x to MAS 9.x.
• Experience migrating an application from SiteMinder to Keycloak or another modern identity broker
• Familiarity with MAS running on Red Hat OpenShift in an on-premises enterprise environment
• Knowledge of Azure DevOps, CI/CD, DevSecOps, automated security scanning, and controlled environment promotion
• Experience supporting utilities, nuclear operations, SOX-controlled systems, NQA-1 environments, or other highly regulated organizations.